cbf9b47e941b3927e046565c23f43d5c18676d12f0f39da25a300a3422e917d2

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 09:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a5685ab461e0049b5c87c0c1e76ddf7_JaffaCakes118.html
Size

20KB
MD5

4a5685ab461e0049b5c87c0c1e76ddf7
SHA1

58a3badefa2d9e3dd095a81794d21ecea7edab7e
SHA256

cbf9b47e941b3927e046565c23f43d5c18676d12f0f39da25a300a3422e917d2
SHA512

bcca79a29db3e2870e498ee067eefcb71c2f3bc08522c102e1c5c65cf4821663581c65276729611fc135789c2c71ebd20e198d346058a4a63d8629e4b8258bc6
SSDEEP

384:QDBMkBM8BM8BM6BM6BMtCKydMzUpf236FJVC02ZQvmD:UCkC8C8C6C6Cid6UM3SeZQvmD

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
1936	msedge.exe
1936	msedge.exe
1648	identity_helper.exe
1648	identity_helper.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 3360	1936	msedge.exe	82
PID 1936 wrote to memory of 3360	1936	msedge.exe	82
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3156	1936	msedge.exe	83
PID 1936 wrote to memory of 3316	1936	msedge.exe	84
PID 1936 wrote to memory of 3316	1936	msedge.exe	84
PID 1936 wrote to memory of 3280	1936	msedge.exe	85
PID 1936 wrote to memory of 3280	1936	msedge.exe	85
PID 1936 wrote to memory of 3280	1936	msedge.exe	85
PID 1936 wrote to memory of 3280	1936	msedge.exe	85
PID 1936 wrote to memory of 3280	1936	msedge.exe	85
PID 1936 wrote to memory of 3280	1936	msedge.exe	85
PID 1936 wrote to memory of 3280	1936	msedge.exe	85
PID 1936 wrote to memory of 3280	1936	msedge.exe	85
PID 1936 wrote to memory of 3280	1936	msedge.exe	85
PID 1936 wrote to memory of 3280	1936	msedge.exe	85
PID 1936 wrote to memory of 3280	1936	msedge.exe	85
PID 1936 wrote to memory of 3280	1936	msedge.exe	85
PID 1936 wrote to memory of 3280	1936	msedge.exe	85
PID 1936 wrote to memory of 3280	1936	msedge.exe	85
PID 1936 wrote to memory of 3280	1936	msedge.exe	85
PID 1936 wrote to memory of 3280	1936	msedge.exe	85
PID 1936 wrote to memory of 3280	1936	msedge.exe	85
PID 1936 wrote to memory of 3280	1936	msedge.exe	85
PID 1936 wrote to memory of 3280	1936	msedge.exe	85
PID 1936 wrote to memory of 3280	1936	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4a5685ab461e0049b5c87c0c1e76ddf7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95ffe46f8,0x7ff95ffe4708,0x7ff95ffe4718
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,3290976692826697843,2005762392253761467,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,3290976692826697843,2005762392253761467,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,3290976692826697843,2005762392253761467,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3290976692826697843,2005762392253761467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3290976692826697843,2005762392253761467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3290976692826697843,2005762392253761467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,3290976692826697843,2005762392253761467,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,3290976692826697843,2005762392253761467,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3290976692826697843,2005762392253761467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3290976692826697843,2005762392253761467,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3290976692826697843,2005762392253761467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3290976692826697843,2005762392253761467,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,3290976692826697843,2005762392253761467,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5280 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
191B

MD5
fce4fc488f427b780caa05dff654c050

SHA1
e5eef5da4bccab7a490a26f11570bc1499a097b8

SHA256
7442580a601d4c4a21d7ac1ac2e036775d2489f7d9cdb367f458858e61fed322

SHA512
38e2dfdb3d656d7d81e7c7eb97180b166bf68d607a4c600b8aa018acba14e67aa3a89a5906cc5575fd09a581f7583672e76b9d899f27dfc8c6a39c3e9cff2ee9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
74221f584137b8f5c47acfdd563b5a67

SHA1
9cfbce7ffcc4c5b9c27c1e6a47d2693a5f1858b7

SHA256
7650e1b7557878149b87a0ab16c53caecfce6b70417a57bbc8becf4629b89fd6

SHA512
1415067e5186d3f1677d560f5d6c66049c272ecba17415805f48ab6d86841360e344c25c43734114e1ce1de906f79e3301be750e709543f8f293319c3cdaa768

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6fe7d110dba57077fbfc84ca52704f0a

SHA1
7ac29b3eace819e297f3e54f19332c121fce9f6f

SHA256
1072ec07c0e44e1313d805070b8a50354aa159cc14ec0150d3d7787e965bf82d

SHA512
d21e3a4e4c9b613e7c7d72e1344c9a8ddd814986dddb38e9342ba4bf82f86034b33d06225c89b933d924596cec0eff4738e3ddf14f7b9d2caed97023c996fba1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a5006319a6de67ad82f2bb3a7e39df01

SHA1
93c10c159c115dc840e8b3080149a9231c75a56b

SHA256
9227d5d73b8dc991a5f862047c91ef203f3e65b642d4ecdc10d352c6056dd387

SHA512
1a5b48004b9236976eaeb971b8316aa54a364b3f4150751b58b205f8b5778b128914619db752506151b9194998b925dc456ed9e36457562bb8b1008d80d854e5

Download Submit